To safely land an aircraft, during the landing flare, the pilot pitches the nose of the aircraft up at an appropriate rate thereby reducing the air-speed in a controlled manner. At the same time, the pilot reduces the engine(s) thrust to idle. Aircraft automatic throttle systems (hereinafter referred to as “autothrottle”) assist the pilot by automatically reducing the engine thrust during the landing flare.
Autothrottle automatically adjusts the throttle at predetermined heights of the aircraft above the ground. A low range radio altimeter (hereinafter referred to as a “LRRA”) determines the height of the aircraft above the ground and feeds that information to the autothrottle. Accurate LRRA readings are critical to the safe landing of the aircraft because an inaccurate reading may result in a premature reduction in thrust. To that end, the LRRA includes internal checks (error flags) to verify proper LRRA operation.
Undetected failures of LRRA can lead to catastrophic accidents. Indeed, such undetected failures have resulted in a number of safety-related instances and at least one major hull-loss accident. On Feb. 25, 2009, a Boeing 737-800 airplane crashed during an attempted landing at Amsterdam Schiphol Airport. The crash investigation determined that as the airplane was approaching the airport, the LRRA erroneously output −8 feet. The internal LRRA controls did not detect the error. As a result of the erroneous LRRA reading, the autothrottle retarded the throttle to the idle position. This caused the autopilot to pitch up the aircraft in an attempt to maintain glide path, causing the aircraft to decelerate and stall. There was insufficient height for the pilots to recover the aircraft. Nine passengers and crew lost their lives.
Thus, autothrottle's sole reliance on LRRA internal verification has proven to be fatal. Accordingly, additional measures to verify LRRA accuracy would greatly improve the safe landing of an aircraft using autothrottle.